When building Docker images, using useradd -l ensures that the new user is created without adding entries to system login tracking files like /var/log/lastlog or /var/log/faillog. These files are irrelevant in containers since they don’t persist user sessions or keep login histories, and in minimal images they may not even exist, which can lead to errors or unnecessary file creation during build.
This makes your image smaller, cleaner, and more reliable. Since containers are designed to run processes rather than serve as full login environments, disabling login record tracking speeds up builds, avoids warnings, and follows best practices for lightweight, secure Docker images.
Non-Compliant Code Examples
RUN useradd -u 123456 foobar
Compliant Code Examples
RUN useradd -l -u 123456 foobar
シームレスな統合。 Datadog Code Security をお試しください
Datadog Code Security
このルールを試し、Datadog Code Security でコードを解析する
このルールの使用方法
1
2
rulesets:- docker-best-practices # Rules to enforce Docker best practices.
